Title
III of the E-Government Act of 2002, entitled the Federal Information Security
Management Act (FISMA) of 2002, requires NIST to prepare an annual public
report on activities undertaken in the previous year, and planned for the
coming year, to carry out responsibilities under this law. The primary goal of
the NIST s Information Technology Laboratory (ITL) Cybersecurity Program, is to
provide standards and technology that protects information systems against
threats to the confidentiality, integrity, and availability of information and
services. During Fiscal Year 2016 (FY 2016), the ITL Cybersecurity Program
successfully responded to numerous challenges and opportunities in fulfilling
that mission. Through ITL's diverse research agenda and engagement in many
national priority initiatives, high-quality, cost-effective security and
privacy mechanisms were developed and applied that improved information
security across the federal government and the greater information security
community. This annual report highlights the research agenda and activities in
which the ITL Cybersecurity Program was engaged during FY 2016.
Application
container technologies, also known as containers, are a form of operating
system virtualization combined with application software packaging. Containers
provide a portable, reusable, and automatable way to package and run
applications. This publication explains the potential security concerns
associated with the use of containers and provides recommendations for
addressing these concerns.
This
document provides the Cybersecurity Framework (CSF) implementation details
developed for the manufacturing environment. The Manufacturing Profile of the
Cybersecurity Framework can be used as a roadmap for reducing cybersecurity
risk for manufacturers that is aligned with manufacturing sector goals and
industry best practices. This Manufacturing Profile provides a voluntary,
risk-based approach for managing cybersecurity activities and reducing cyber
risk to manufacturing systems. The Manufacturing Profile is meant to enhance
but not replace current cybersecurity standards and industry guidelines that
the manufacturer is embracing.
This
proceedings documents the July 11-12, 2017 "Enhancing Resilience of the
Internet and Communications Ecosystem" workshop led by National Institute
of Standards and Technology Standards. Executive Order 13800,
"Strengthening the Cybersecurity of Federal Networks and Critical
Infrastructure" required the Secretaries of Commerce and Homeland Security
to "jointly lead an open and transparent process to identify and promote
action by appropriate stakeholders to improve the resilience of the internet
and communications ecosystem and to encourage collaboration with the goal of
dramatically reducing threats perpetrated by automated and distributed attacks
(e.g., botnets)."
Phishing,
the transmission of a message spoofing a legitimate sender about a legitimate
subject with intent to perform malicious activity, causes a tremendous and
rapidly-increasing amount of damage to American information systems and users
annually. This project implements an exploratory computational model of user
decision making in a potential phishing attack scenario. The model demonstrates
how contextual factors, such as message subject matter match to current work
concerns, and personality factors, such as conscientiousness, contribute to
users decisions to comply with or ignore message requests.
Wireless connections are becoming
popular in industrial environments that increasingly carry sensing and
actuation data over the air. In industrial plants, activities of legacy
wireless systems have shaped the channel usage in the radio spectrum bands for
new wireless applications. The 2 GHz spectrum band consists of a good number of
radio resources that are dedicated to fixed and mobile wireless communications.
In this report, passive measurement data collected in two industrial plants is
analyzed to identify existing wireless activities in this frequency band.
Besides, a statistical channel usage model is developed for the 2.4 GHz
Industrial, Scientific and Medical (ISM) band. The secondary spectrum utility
is evaluated given legacy wireless activity in the ISM band, which is of
particular interest to unlicensed industrial wireless networking standards,
such as WirelessHART and ISA100.11a.
|
